MAESTRO 7-layer threat model — Ujex coverage

MAESTRO is the Cloud Security Alliance's 7-layer threat model for agentic systems (Feb 2025). It extends STRIDE / PASTA / LINDDUN with agent-specific concerns. Below, each layer is mapped to the Ujex primitives that mitigate it.

L1 — Foundation models

Threats: prompt-injection, jailbreak, hallucination-driven action. Ujex coverage: PI scoring on inbound mail (Inbox); Approvals default-deny; trust_level tagging on every row.

L2 — Runtime

Threats: RCE via tool execution, resource exhaustion, unsafe runtime fan-out. Ujex coverage: server-side tool dispatch, recursion guard (maxSteps), and Budgets kill switch. Pods are tenancy/role grouping, not a default container sandbox; sandboxed MCP dispatch remains post-launch hardening.

L3 — Identity

Threats: stolen device key, agent impersonation, NHI sprawl. Ujex coverage: device keys stored as sha256; rotateDeviceKey callable; scoped custom tokens; agent DID issuance plan (W3C Agent Identity Registry CG).

L4 — Tool layer

Threats: poisoned tool (MITRE ATLAS v5.4 "Publish Poisoned AI Agent Tool"), tool credential leak, MCP-server compromise. Ujex coverage: server-side tool policy, Budgets preflight, mandatory signed-manifest registration, per-call audit row, and MCP/HTTP dispatch with credentials injected server-side. Legacy broker tokens fail closed for launch.

L5 — Memory

Threats: context poisoning, memory exfiltration, training-data leakage. Ujex coverage: per-agent isolation; trust_level per memory write; PI-score gating on auto-ingest; hash-chained audit row on every memory write.

L6 — Inter-agent

Threats: delegation abuse, A2A trust assumption, cascading failures. Ujex coverage: every delegation signed and audited; capability tokens scope-subset-enforced; recursion guard prevents cascading.

L7 — Human / business

Threats: social engineering, EchoLeak-style exfiltration, regulatory non-compliance. Ujex coverage: app/dashboard approvals with push notification when configured; lethal-trifecta enforcement; AAT export for Article 12.

Compounding controls

Mitigations are layered, not exclusive. A high-risk action like "send email to new recipient with attachment" passes through L1 (PI score on the inbound mail that requested it), L4 (server-side tool policy and credential injection), L6 (delegation chain), L7 (approval gate), and lands a chained audit row covering all of them.